Unpackme

You start here:

01007D80 >  9C              PUSHFD
01007D81    60              PUSHAD
01007D82    B8 E4190001     MOV EAX,final.010019E4
01007D87    8030 66         XOR BYTE PTR DS:[EAX],66
01007D8A    40              INC EAX
01007D8B    3D 8B6A0001     CMP EAX,final.01006A8B
01007D90  ^ 75 F5           JNZ SHORT final.01007D87                   ; Set BP after this JNZ to exit the loop
01007D92    BB 00800001     MOV EBX,final.01008000
01007D97    8033 77         XOR BYTE PTR DS:[EBX],77
01007D9A    43              INC EBX
01007D9B    81FB F09F0001   CMP EBX,final.01009FF0
01007DA1  ^ 75 F4           JNZ SHORT final.01007D97                   ; Set BP after this JNZ to exit the loop
01007DA3    36:C705 FCFF060>MOV DWORD PTR SS:[6FFFC],final.01002801    ; Keep in mind the address which is MOV to Stack address 0006FFFC...
01007DAE    68 BA7D0001     PUSH final.01007DBA                        ; ASCII "hÆ}"
01007DB3    E8 01000000     CALL final.01007DB9
01007DB8    C3              RETN
01007DB9    C3              RETN
01007DBA    68 C67D0001     PUSH final.01007DC6                        ; ASCII "hÒ}"
01007DBF    E8 01000000     CALL final.01007DC5
01007DC4    C3              RETN
01007DC5    C3              RETN
01007DC6    68 D27D0001     PUSH final.01007DD2                        ; ASCII "hÞ}"
01007DCB    E8 01000000     CALL final.01007DD1
01007DD0    C3              RETN
01007DD1    C3              RETN
01007DD2    68 DE7D0001     PUSH final.01007DDE                        ; ASCII "h��}"
01007DD7    E8 01000000     CALL final.01007DDD
01007DDC    C3              RETN
01007DDD    C3              RETN
01007DDE    68 EA7D0001     PUSH final.01007DEA                        ; ASCII "hö}"
01007DE3    E8 01000000     CALL final.01007DE9
01007DE8    C3              RETN
01007DE9    C3              RETN
01007DEA    68 F67D0001     PUSH final.01007DF6                        ; ASCII "a?h��j"
01007DEF    E8 01000000     CALL final.01007DF5
01007DF4    C3              RETN
01007DF5    C3              RETN
01007DF6    61              POPAD
01007DF7    9D              POPFD
01007DF8    68 E06A0001     PUSH final.01006AE0
01007DFD    C3              RETN                                       ; After this RETN you are on OEP

- Just step with F8 in Ollydbg until you arrive @ OEP (exit the loops with F2/Shift+F9)
- Dump with your favorite dumper (lord pe / dump full)
- Use OEP 01006AE0 sub ImageBase (1000000) and fill your ImpRec with it
- Fix the dump with it

Fix the not starting dump:

Remember the Address which was MOV onto Stack at the beginning? This is the reason why our dump is not working ..

find this in your dump:

01006C45   > \6A 0A         PUSH 0A
01006C47   .  58            POP EAX
01006C48   >  50            PUSH EAX
01006C49   .  56            PUSH ESI
01006C4A   .  53            PUSH EBX
01006C4B   .  53            PUSH EBX
01006C4C   .  FFD7          CALL EDI
01006C4E   .  50            PUSH EAX
01006C4F   .  E8 9C130000   CALL dumped_.01007FF0

The marked CALL leads to this jump ..

01007FF0   $  36:FF25 FCFF0>JMP DWORD PTR SS:[6FFFC]

You should now understand why it is not working .. @ 0006FFFC is only 00000000 so it crashed ..

What we have to do now? We fix the CALL to the real Destination and have a working dump...

Change

01006C4F   .  E8 9C130000   CALL dumped_.01007FF0

to

01006C4F      E8 ADBBFFFF   CALL dumped_.01002801

and save with right click -> Copy to executable -> All modifications now save file and enjoy this great application ..

thx to KaGra for this .. i hope this is the solution you wanted to hear .. and its the same unpackme you send me ..

have a nice day